The most common question I hear about Database Accounts is, “Can your solution vault Database Service and other Privileged Database Accounts?” Every time I hear this question, a voice in the back of my head wants to ask, “Have you implemented modern approaches to Database Authentication and Authorization Management?” See the real problem is the majority of Databases and the hosted Database Instances still have legacy Database Authentication and Authorization methodologies applied to them, so we are trying to apply a band-aid to the issue by reaching into the databases and vault the DB local accounts. THREE DATABASE APPROACHES Let’s…

At Centrify, an AWS Partner Network (APN) Advanced Technology Partner, we frequently work with developers building applications on Amazon Web Services (AWS). While many aspects of app development and deployment on AWS have been streamlined, authentication of end-users into apps remains challenging. A traditional approach is to implement your own identity repository using a relational database or directory server. You are responsible for securing and storing user identities, implementing identity lifecycle management functions to create new users, implementing password policies, and recovering lost passwords. Another option is to use Amazon Cognito, which enables you to add code to your application to authenticate users either…

This week, BlackHat USA commemorates its 21st year, taking over the Mandalay Bay Convention Center in Las Vegas to present trainings as well as recent developments and research about cybersecurity trends, best practices, and more. Centrify will once again be present to carry the flag for Next-Gen Access as an empowering force behind Zero Trust Security. You can find us at booth #2410 in the Oceanside Ballroom of the Business Hall, BlackHat’s latest euphemism for the vendor Expo. For more details about Centrify’s presence and other fun things happening at our booth, please read Michele Hayes’s blog from last week….

While phishing attacks continue to jeopardize today’s organizations (a reported 76% of organizations experienced phishing attacks in 2017), it was refreshing to hear that tech giant Google has apparently eliminated phishing by giving security keys to all of its 85,000 employees. “We have had no reported or confirmed account takeovers since implementing security keys at Google,” a company spokesperson told Krebs on Security last week. “Users might be asked to authenticate using their security key for many different apps/reasons. It all depends on the sensitivity of the app and the risk of the user at that point in time.” This…

BlackHat USA 2018 kicks off in Las Vegas next week, the 21st year that the information security event has brought together thousands of cybersecurity professionals. BlackHat is always a unique event in that it devotes a heavier portion of its agenda to technical trainings, skill-building, and research briefings for practical cybersecurity learning, followed by a shorter main conference we typically encounter at a “trade show.” It’s also co-located with DEFCON, a hacker convention that takes place immediately following BlackHat – that’s always interesting. Whether you go to the whole event, just the technical sessions, or the Business Hall (aka The…

CISOs are overwhelmed with a multitude of projects that are pulling at their time and resources. All of these projects feel important and usually will have some benefit, but nobody has the time or budget to do it all. So which projects will give you the biggest bang for your buck? How do security professionals prioritize these initiatives? At this year’s Gartner Security and Risk Management Summit, Gartner’s Neil MacDonald revealed the analyst firm’s top 10 recommended security projects for 2018. MacDonald stated that CISOs need to, “focus on projects that reduce the most amount of risk and have the…

Security breaches are now all too commonplace — 58% of organizations have experienced at least one in the past 12 months. As a result, IT security leaders are urgently scrambling to defend attacks at every entry point. Worse yet, traditional approaches to security, based on the notion that you can keep out the “bad guys” out while letting in the good guys, have proven ineffective. Access control strategies that focus on separating trusted from untrusted users are missing the whole point. Mobile proliferation, reliance on outsourced partners and cloud technologies, and the regular occurrence of insider attacks mean that there…

Customer Identity and Access Management (CIAM) is essentially a set of tools that allow your business to securely authenticate, manage and engage customers who are consuming products and services through your applications. Historically, customer identity has not always been top of mind when it comes to business-driving initiatives. Identity was simply a feature of the application, maybe a table or directory that stored user information. It was just there, without much need to think about it. Fast forward to present day and things have changed dramatically. Customers have now come to expect that their own preferences (likes, dislikes, purchase history)…

There are lots of maxims in the startup world about passion, patience and perseverance — but most of the time it is just lip service. Rarely do founding teams stick together and fight though more than a decade of ups and downs. But that is exactly what the Centrify founders have done for the last 14 years, beginning inside Mayfield’s offices in March of 2004. Success is the result of perfection, hard work, learning from failure, loyalty and persistence. — Colin Powell To help reset the context, in 2004 Lance Armstrong won his 6th Tour de France and the Boston…

Reputation is built on trust – yet the paradox in the age of access is that the only way we can build trust is to eschew it. That age-old tool of identification–the password–no longer provides any level of security and, in fact, depending upon a password for protection is probably the worst mistake one can make. Likewise, relying on technology alone, such as firewalls, malware detectors and anti-virus programs, can create a false sense of security that often causes more problems than it solves. LESSONS FROM AUSTRALIA If you doubt that assumption, look at the volume of business disruption that…

Secure Thinking by Tom Kemp

Centrify CEO Tom Kemp, an industry expert in security and infrastructure software, discusses market and technology issues around the disruption occurring in the Identity and Access Management market due to the cloud, mobile and consumerization of IT trends occurring in today's IT environment.